Malicious Android security app could be related to Zeus Trojan

A fake Android security application discovered recently is most likely a mobile component of the Zeus banking malware, security researchers from antivirus firm Kaspersky Lab said this week.

By
Lucian Constantin
| Jun 20, 2012

| IDG News Service

Share

TwitterFacebookLinkedInGoogle Plus

A fake Android security application discovered recently is most likely a mobile component of the Zeus banking malware, security researchers from antivirus firm Kaspersky Lab said this week.

Called Android Security Suite Premium, the rogue app is capable of stealing SMS messages and uploading them to a remote server. When launched, the app displays a shield image that has long been associated with Windows fake antivirus programs, also known as FakeAV or scareware.

"How could I ever forget such an identifiable logo," Nathan Collier, a threat research analyst at antivirus firm Webroot, said . "Now that the developers of the popular FakeAV malware have entered into the mobile world expect to to see a lot more variations of this."

However, this might not be a mobile scareware app, but a new variant of ZitMo - Zeus in the Mobile, said Kaspersky Lab senior malware analyst Denis Maslennikov.

ZitMo apps are malicious mobile applications that are used by cybercriminals in conjunction with the Zeus computer Trojan in order to steal money from online banking accounts. They appeared back in 2010 as a response to banks implementing mobile-based security measures.

Their purpose is to steal mobile transaction authorisation numbers (mTANs) sent by banks to their customers via SMS messages. Without mTANs, fraudsters wouldn't be able to authorise transactions initiated with stolen credentials.

Related

The registration information for the domain names where Android Security Suite Premium uploads stolen SMS messages matches the registration information for 2011 Zeus command-and-control domains, Maslennikov said. This, coupled with the app's SMS-stealing functionality makes it likely that this is a new ZitMo version.

Even though this app displays an activation code when opened, it doesn't display fake security alerts and doesn't ask users for money like scareware applications do, Maslennikov said. "It's not a fake AV - 100%."

Kaspersky researchers are still analysing how the malicious app is being distributed. It's possible that, like with previous ZitMo versions, attackers are using social engineering to trick victims into downloading it, Maslennikov said.

The Zeus computer Trojan has the ability to inject pop-ups into online banking websites when they are opened on infected computers. This functionality has been used in the past to distribute ZitMo apps as security updates from the targeted banks.

In a similar way, the Android Security Suite Premium might be advertised as a free Android security product offered by the victim's bank.

As security researchers recommended in the past, users should only install Android apps from the official Google Play website and should always look at an app's reviews and download statistics to determine if it's trustworthy.